CVE-2021-27290

npm/ssri CVE-2021-27290: high 7.5

Regular Expression Denial of Service (ReDoS)

Action: Upgrade ssri to 6.0.2 or later.

npm i ssri@6.0.2

npm i ssri@7.1.1

npm i ssri@8.0.1

Affected

Fixed versions

Sources

• osv: GHSA-vx3p-948g-6vhq
• https://nvd.nist.gov/vuln/detail/CVE-2021-27290
• https://github.com/npm/ssri/pull/20#issuecomment-842677644
• https://github.com/npm/ssri/commit/76e223317d971f19e4db8191865bdad5edee40d2
• https://github.com/npm/ssri/commit/809c84d09ea87c3857fa171d42914586899d4538
• https://github.com/npm/ssri/commit/b30dfdb00bb94ddc49a25a85a18fb27afafdfbb1
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf
• https://github.com/npm/ssri
• https://github.com/yetingli/SaveResults/blob/main/pdf/ssri-redos.pdf
• https://npmjs.com
• https://www.npmjs.com/package/ssri
• https://www.oracle.com/security-alerts/cpuoct2021.html

CVE-2021-27290 · published 2021-03-19T21:24:36Z · modified 2023-11-08T04:05:24.003426Z · JSON